topic Re: R80.10 - VPN traditional mode to simplified mode in General Topics

R80.10 - VPN traditional mode to simplified mode

HeikoAnkenbrand — Wed, 20 Mar 2019 21:16:13 GMT

We have the following problem. We have a SMS with version R80.10. Now, we have add a new 1490 SMB Appliance Cluster to the policy. If we install the SMB cluster policy, we become the following error: "VPN configuration in traditional mode is not supported on Check PointSmall Office Appliances."

Under R77.30 I can use the wizard to convert the traditional mode policy to simplified mode policy.

With R80.10 I can no longer found this wizard.

Now my question:

Is it possible to convert the traditional mode VPN policy to simplified mode?

What do I have to do under R80.10.

Regards

Heiko

Re: R80.10 - VPN traditional mode to simplified mode

PhoneBoy — Thu, 23 Aug 2018 01:14:54 GMT

I know new Traditional Mode VPNs cannot be created in R80.x.

I presume we did not port the relevant wizard to R80.x since Simplified Mode VPNs have been the default since R5x.

My guess: you'll have to do it manually.

Re: R80.10 - VPN traditional mode to simplified mode

HeikoAnkenbrand — Thu, 23 Aug 2018 06:28:24 GMT

Hi Dameon,

THX for the fast answer.

The problem with historical Traditional Mode VPN features.

(migration path over the years R5x > R6x> R7x >R80.10)

Small suggestion for improvement:

Maybe you should get a warning when executing "migrate export" or "pre upgrade verifier" here.

Regards

Heiko

Re: R80.10 - VPN traditional mode to simplified mode

PhoneBoy — Thu, 23 Aug 2018 13:45:53 GMT

I'm surprised you don't get such a warning (especially if we don't include the conversion wizard).

Tomer Sole‌, think we might be able to suggest this get added?

Re: R80.10 - VPN traditional mode to simplified mode

_Val_ — Fri, 24 Aug 2018 11:45:43 GMT

Second that.

Re: R80.10 - VPN traditional mode to simplified mode

Mia_Stephanson — Fri, 24 Aug 2018 13:37:36 GMT

when you run the upgrader verification service you get a warning.

Thank you for using the Check Point R80.10 upgrade verification service.The upgrade verification service has simulated your upgrade to R80.10

Firewall policies with Traditional VPN mode

Description:

Traditional mode refers to legacy VPN policy, which was replaced by Simplified VPN (first introduced at 2002 in version NG FP3). Please change the below policies by using one of the methods:
1. Convert your Firewall policies: In SmartConsole, go to Policy > Convert To > Simplified VPN, and follow the wizard instructions.
2. In your Firewall policy, delete rules that contain the actions Encrypt or Client Encrypt.
If you have a specific case in which you have to use Traditional VPN mode, please contact Check Point support.
These are the Traditional VPN policies or rules that must be converted or deleted:

Re: R80.10 - VPN traditional mode to simplified mode

PhoneBoy — Fri, 24 Aug 2018 16:49:35 GMT

Wonder if it shows when you run pre_upgrade_verifier on the CLI or if that shows only on the online one.

Re: R80.10 - VPN traditional mode to simplified mode

HeikoAnkenbrand — Fri, 24 Aug 2018 17:23:05 GMT

Thanks Mia for your answer.

This is SMS R80.10. Unfortunately this is no longer available.

This works for older versions R77.30 and lower:-)

Regards

Heiko

Re: R80.10 - VPN traditional mode to simplified mode

Myo_Min_Zaw — Wed, 31 Oct 2018 12:57:38 GMT

Hi,

What will happen to VPN configuration after convert to simplified VPN rules?

Need to create for IPsec VPN communities manually after conversion?

Based-on my conversion, need to setup for VPN communities configuration after conversion.

Thanks.

Re: R80.10 - VPN traditional mode to simplified mode

James_Hawkins — Thu, 01 Nov 2018 10:08:24 GMT

We have the same issue.

😞

Re: R80.10 - VPN traditional mode to simplified mode

Maarten_Sjouw — Thu, 01 Nov 2018 15:48:51 GMT

A few weeks back I was trying to add an Inline Layer for APCL/URLF o a policy and it would not let me due to the fact it was a Traditional Mode VPN policy.

Thing was there was No VPN at all, IPSEC was turned off on the gateway, but still it was nagging about it.

In this case there was nothing to convert but just copy to a new policy and all done, but still...

Re: R80.10 - VPN traditional mode to simplified mode

Ilya_Yusupov — Tue, 06 Nov 2018 10:49:09 GMT

can you please share the builds you are using of R80.10?

Re: R80.10 - VPN traditional mode to simplified mode

net-harry — Sat, 09 Jan 2021 09:57:13 GMT

Hi,

We also have a few security gateways that are using a Traditional Mode VPN Policy.

They do not have any VPN configuration and we would like to convert them to simplified mode to be able to create Inline Layer for APCL/URLF.

I just noticed sk171035 where it seems we could disable the Traditional Mode with the following command:

Disable Traditional VPN mode
# mgmt_cli -r true -d DOMAIN_NAME set package name "POLICY_PACKAGE_NAME" vpn-traditional-mode false --format json

Could anyone confirm if this would change the policy to be a "fully" Simplified VPN Policy?

Please note that the article title is "How to convert a Simplified VPN Policy to a Traditional VPN Policy in R80.X", but I think the title should be "How to convert a Traditional VPN Policy to a Simplified VPN Policy in R80.X"

We are running version R80.20, take 183.

Thanks for your help!

Best regards,

Harry

Re: R80.10 - VPN traditional mode to simplified mode

PhoneBoy — Sat, 09 Jan 2021 18:15:06 GMT

That SK was created…yesterday.
The way I read it is that command merely flips the bit in the policy layer so that it will be marked as a simplified VPN mode instead of traditional VPN mode.
It won’t actually convert any traditional VPN rules to simplified VPN rules, but if you don’t have any VPN rules in that layer…it should do the trick.

Re: R80.10 - VPN traditional mode to simplified mode

net-harry — Sat, 09 Jan 2021 20:56:47 GMT

Thanks @PhoneBoy, this is how I also understood the article. Do you know why this information was not released earlier, since this looks like a simple fix? We were considering manually recreating the whole policy, but hesitated since it would require a lot of effort. @Maarten_Sjouw mentioned that he copied to a new policy to solve it, but at least when I try to clone the policy it still shows up as VPN Traditional mode.

Re: R80.10 - VPN traditional mode to simplified mode

_Val_ — Mon, 11 Jan 2021 06:56:30 GMT

No, it is not a simple fix. Traditional has phase 2 parameters defined per rule, and dropping this info is something that can backfire.
The technique in the mentioned SK has had to be verified and proven to be safe, before publishing.

Re: R80.10 - VPN traditional mode to simplified mode

net-harry — Mon, 11 Jan 2021 09:31:34 GMT

Thank you @_Val_. I fully understand that the fix would be difficult if VPN is used, but in our case we do not have VPN configured on those gateways.

Could you confirm if changing the package parameter (vpn-traditional-mode to false) on the policy would be the same as creating a new policy in simplified mode?

Thanks for your help!

Re: R80.10 - VPN traditional mode to simplified mode

_Val_ — Mon, 11 Jan 2021 09:54:40 GMT

Then you are good to go. Technically, it is not the "same", but it will work for you.

Re: R80.10 - VPN traditional mode to simplified mode

net-harry — Mon, 11 Jan 2021 11:02:09 GMT

Thanks for the information @_Val_. Would you be able to explain in which way it would be technically different? I would like to avoid facing an issue in the future due to using this method to change to simplified mode instead of creating a new policy as simplified mode.

Also, please note that the article title still says "How to convert a Simplified VPN Policy to a Traditional VPN Policy in R80.X", but I think it should be "How to convert a Traditional VPN Policy to a Simplified VPN Policy in R80.X"

Re: R80.10 - VPN traditional mode to simplified mode

_Val_ — Tue, 12 Jan 2021 08:49:45 GMT

Without VPN rules defined, it is practically the same. Otherwise, there are quite a few places where local definitions should be flipped/ignored/overwritten.

As already mentioned above, if you did not have any VPN, and just the policy was marked "Traditional", there is no risk, AFAIK